The cybersecurity industry produces an overwhelming amount of content every day: blogs, threat reports, podcasts, white papers, and social media analysis. The problem isn’t access to information. The problem is knowing what is actually worth your time.

In this session, Rick Howard, CEO of the Cybersecurity Canon Project and author of Cybersecurity First Principles, argues that the fastest way to deepen professional expertise is counterintuitive: stop skimming everything and start reading a few things deeply.

Drawing on lessons from the Cybersecurity Canon Hall of Fame, a curated collection of the most influential books ever written about cybersecurity, Howard will walk through several key works that have shaped the industry.

Attendees will learn:

● Why the cybersecurity profession suffers from a signal-to-noise problem in knowledge consumption

● Why books remain the most powerful knowledge-transfer mechanism in technical fields

● How a handful of seminal works shaped modern cybersecurity thinking

● A practical approach to building your own deep-reading roadmap

If you want to sharpen your thinking, accelerate your professional growth, and focus your learning on the ideas that actually matter, this session will give you the starting point.

News headlines show you the breaches at massive corporations, but it’s everyday organizations that face the most threats. Adversaries prey on the human psyche and use AI to advance their tactics and target the companies that keep our communities running.  For these companies, a ransomware or BEC attack isn’t just a stressful event—it’s the reason they can’t make payroll. This session explores how hackers plan to win, and why you don’t need a massive budget to fight back.  We’ll get into how Huntress brings cyber resilience through a powerful combo of purpose-built technology and human SOC expertise to stop threats before they cause damage—because organizations of ALL sizes deserve a fighting chance against attackers.

Identity-based attacks are a CISO's nightmare, with 90% of cyber intrusions leveraging phished or leaked credentials and privilege escalation. Once compromised, attackers can move anywhere across the data estate and are frequently infiltrating your cloud environments. In this session, we'll dive into the unified approach of Rubrik Identity and Cloud Resilience, demonstrating how it goes beyond traditional data protection to secure your entire hybrid identity, including Active Directory and Entra ID, as well as safeguarding your ability to recover data after an incident. We'll explore how to proactively manage identity and data risk, continuously monitor for changes, and—when prevention fails—orchestrate a fast, clean recovery of all of your data across your identity and cloud platforms. You will learn how your organization can maintain business continuity, even in the face of a catastrophic event.

Abstract
AI and new digital technologies will continue to shift the cybersecurity landscape in 2026. This session explores how modern tools can enhance detection, response, and decision making while introducing new risks tied to generative systems, data integrity, and fast moving threat innovation. Leaders will gain a clear view of how to adopt emerging technology in a responsible and strategic way that supports resilience and aligns with enterprise risk goals.

Key Takeaways
• How AI and emerging tech are reshaping core security functions
• The new risks created by generative models and evolving attack techniques
• Practical governance steps that support responsible AI use
• Examples of organizations pairing innovation with disciplined risk management

As cyber risk becomes business risk, organizations are being forced to rethink not just their technology, but their talent strategy. 

The convergence of AI-driven threats, operational technology (OT) exposure, and expanding digital ecosystems is outpacing the ability of traditional cybersecurity teams to respond. At the same time, a global shortage of nearly 4.8 million cybersecurity professionals continues to widen, leaving organizations increasingly exposed  

This session challenges leaders to move beyond hiring models and toward pipeline engineering, aligning workforce strategy directly to resilience, risk reduction, and measurable business outcomes. 

Attendees will explore how to: 

• Align cybersecurity talent strategy with enterprise risk priorities and operational resilience  

• Build future-ready workforce pipelines across AI, OT, and cyber-physical systems  

• Shift from reactive staffing models to scalable, capability-based workforce design  

• Translate workforce investments into business performance, not just security posture  

Ransomware is still widely framed as a criminal nuisance — an IT problem to be managed with better tools, faster detection, and stronger compliance. That framing is no longer just outdated. It is costing lives. When ransomware takes down a hospital's electronic health records, patients are diverted from emergency care. When it disrupts a 911 dispatch center, help doesn't arrive. When it shuts down water treatment or power grids, entire communities face existential risk. These are not inconveniences. These are acts of violence — deliberate, targeted, and inflicted on the most vulnerable among us. The fact that the weapon is code does not make the harm any less real. Today's most destructive ransomware operations are not opportunistic. They are organized, well-resourced campaigns that deliberately target systemically important critical infrastructure — hospitals, emergency services, water systems, and energy grids — with full knowledge that human lives hang in the balance. These actors understand exactly what they are doing. They are not stealing data. They are holding lives hostage. This keynote argues that the criminal framework we apply to ransomware is catastrophically mismatched to the threat. When an attack is designed to coerce societies by threatening civilian safety, when it targets the systems people depend on to survive, and when it is carried out with strategic intent — that is not cybercrime. That is terrorism. And our legal designations, our policy responses, and our collective posture must reflect that reality. The session will examine how advances in AI, identity-based attacks, and third-party ecosystem exposure are accelerating attacker capabilities and expanding blast radius across interconnected critical systems. It will make the case that detection, compliance, and post-incident recovery — while necessary — are insufficient responses to acts of violence. Resilience matters. But so does accountability. Most importantly, this keynote is a call to action. Reclassifying the most destructive ransomware actors as terrorists is not a radical idea — it is a moral and strategic imperative. Achieving it requires a coalition: security leaders, policymakers, legal scholars, healthcare executives, and infrastructure operators who are willing to say, publicly and persistently, that this line has been crossed. Attendees will leave with a clear understanding of why the current model is failing, what a terrorism designation would actually mean in practice, and — most importantly — how they can join a growing movement to demand that our laws, our institutions, and our society treat attacks on human life with the gravity they deserve. The worst ransomware actors are not hackers. They are violent actors hiding behind keyboards. It's time we treated them that way. Join us.

Abstract:
As organizations expand their digital ecosystems, risks extend far beyond internal networks. Threat actors are increasingly exploiting supply chains, third-party vendors, and identity gaps to gain access. This session brings together cybersecurity leaders and solution providers to explore how these interwoven risks create a complex attack surface -and how technology can help mitigate them.

Panelists will share real-world examples, lessons from managing large vendor networks, and innovative tools and frameworks for continuous risk assessment. Discussions will highlight strategies for mapping hidden dependencies, enforcing strong identity governance, and strengthening resilience through automation, collaboration, and transparency. Attendees will gain actionable insights on reducing exposure, improving third-party risk visibility, and leveraging technology to secure their extended digital ecosystem.

Key Takeaways:
• Understand how supply chains, vendors, and identities amplify organizational risk.
• Explore practical methods and tools for assessing, monitoring, and mitigating third-party and ecosystem vulnerabilities.
• Learn how to treat identity as a security perimeter using zero trust, access governance, and automated solutions.
• Gain insights from real-world breaches that reveal common gaps in vendor and identity controls.
• Walk away with a technology-informed framework to enhance resilience, secure partnerships, and reduce exposure across your digital ecosystem.

The cyber threat landscape continues to evolve rapidly, with the IT sector regularly targeted as a gateway to impact broader supply chains. Drawing on insights from the Information Technology - Information Sharing and Analysis Center (IT-ISAC) updated annual cyber threat report, this session will provide a concise overview of the sector’s top threats of 2025. Highlights include an overview of the actors most aggressively targeting IT companies and a rundown of the tactics, techniques, and procedures most commonly used by these adversaries, as well as a more specific look at ransomware groups and their impact on the sector.

The presentation will also explore what lies ahead in 2026 as advances in technology, especially artificial intelligence, enable faster, more scalable cyberattacks. Attendees will leave with a clear understanding of the evolving IT threat landscape, and actionable insights to help their teams strengthen resilience and reduce risk across their own organizations and associated supply chains.

The chronic shortage of effective cybersecurity talent is a critical national security, as well as economic and company competitiveness issue. And unlike in other tech segments, AI advancements are likely to increase the number of cybersecurity openings with AI governance, administration of embedded AI cybersecurity capabilities, and AI-empower hacking creating more jobs than automation will eliminate.

There is a segment of our population - in fact, a majority of our fellow Americans - who have no path to cybersecurity jobs even though they may have the requisite, fundamental aptitude. This session explores an experiment by cybersecurity software/service providers, and "end user companies" with significant cybersecurity operations to determine how they might be able to tap this job-ready talent pool - and the program that is scaling the solution across the country.

Abstract:
Cybersecurity challenges are complex, and solving them requires teams with diverse perspectives, skills, and experiences. This panel explores how diversity drives better problem-solving, innovation, and threat detection in security organizations.

Panelists will share strategies for attracting and retaining talent from varied backgrounds, leveraging unique thinking styles, and applying different experiences to uncover blind spots in risk management. Attendees will gain actionable insights for building teams that are not only technically skilled but more adaptive, creative, and resilient in the face of evolving cyber threats.

Key Takeaways:

• Understand how diversity strengthens problem-solving, innovation, and threat response.
• Learn approaches to recruit and retain talent from non-traditional backgrounds.
• Explore how different perspectives and thinking styles reveal hidden risks.
• Gain strategies to create teams that are adaptable, collaborative, and resilient.
• Walk away with practical ideas for integrating diversity into cybersecurity team design and strategy.

When generative AI (GenAI) hit the consumer market with the release of OpenAI’s ChatGPT, users worldwide flocked to the product and started experimenting with the tool’s capabilities across industries. The release also sent an instant panic through the hearts of information security professionals, whose job it is to protect organizations from risks including the loss or theft of sensitive data — including personally identifiable information (PII), protected health information (PHI) and sensitive corporate data and intellectual property. In addition to data loss, publicly available GenAI solutions have risks including model poisoning, prompt injection, bias, data poising, and maliciously generated code. This session will explore 2 options for securing GenAI solutions, while protecting against the egress of sensitive data from your organization.